Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Exhibit
Refer to the exhibit.
```json
{
"properties": {
"description": "Allow access to storage account from specific virtual network",
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
"then": {
"effect": "deny",
"details": {
"networkAcls": {
"defaultAction": "Deny",
"virtualNetworkRules": [
{
"id": "/subscriptions/sub-id/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet1",
"action": "Allow"
}
]
}
}
}
}
}
}
```You are reviewing an Azure Policy definition that applies to storage accounts. The policy has an effect of 'deny' and specifies network ACLs. What is the intended behavior of this policy?
⚠ Common exam trap
Many exam-takers confuse the 'deny' effect on resource creation with network-level traffic denial, not realizing that Azure Policy controls resource configuration compliance, not runtime traffic flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny creation of storage accounts that do not have a virtual network rule allowing vnet1 and default action set to Deny
The Azure Policy definition with effect 'deny' and network ACL conditions will block the creation of any storage account that does not include a virtual network rule allowing 'vnet1' and does not have the default action set to 'Deny'. This ensures that only storage accounts with the specified network restrictions are permitted, enforcing a security baseline that denies all traffic except from the allowed virtual network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all storage accounts to be created regardless of network rules
Why it's wrong here
This option is incorrect because Azure Policy definitions with a 'Deny' effect explicitly prevent resource creation or update if the specified conditions are not met. The policy's purpose is to enforce specific network rules, such as requiring a virtual network rule and a 'Deny' default action, rather than allowing all storage accounts to be created indiscriminately. Therefore, it actively restricts non-compliant deployments, directly contradicting the idea of allowing all storage accounts.
- ✗
Deny all traffic to storage accounts
Why it's wrong here
This option is incorrect because Azure Policy operates at the control plane level, governing resource deployment and configuration changes (create, update, delete). It does not directly control data plane operations like network traffic flow to or from a storage account. Network traffic management, such as denying all traffic, is handled by data plane controls like Network Security Groups (NSGs) or the storage account's own firewall rules, not by a policy enforcing resource configuration during creation.
- ✓
Deny creation of storage accounts that do not have a virtual network rule allowing vnet1 and default action set to Deny
Why this is correct
This option is correct because the policy's 'Deny' effect, combined with its conditions, prevents the deployment of any new storage account that does not meet the specified network access requirements. Specifically, it ensures that a storage account must have a virtual network rule allowing access from 'vnet1' and that its default network action is set to 'Deny', thereby blocking all other traffic by default. This enforces a secure network posture at the time of resource provisioning.
- ✗
Allow only traffic from the specified virtual network
Why it's wrong here
This option is incorrect because Azure Policy, with a 'Deny' effect, prevents the creation of non-compliant resources; it does not directly manage or 'allow' network traffic. While the policy's intent is to ensure that the *configured* storage account will only allow traffic from the specified virtual network, the policy itself acts as a gatekeeper for resource deployment. It enforces the necessary configuration that subsequently allows traffic, rather than performing the traffic allowance itself.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.